Cloudron Forum

[1.40.1] Update calibre-web to 0.6.27 Full Changelog !Attention! For this update nh3 has to be installed !Attention! MOBI files now support metadata extraction on upload Reverse proxy login with shared secret header implemented Cover path is now selected based on the correct setting instead of the presence of split_path (#3527) Title sort with "l'" now works correctly in French Kobo sync behind reverse proxy now works correctly: library_sync URL is rewritten in init response Login failure now returns HTTP 401 Infinite scroll now triggers correctly on mobile browsers (#3664) UNIQUE constraint crash on transliteration-identical authors is now fixed (#3403, #3170) XSS payload in book comments imported via Calibre is now sanitized before display (reported by @Nozomu Sasaki)

[3.18.4] Update WordPress to 7.0.4 Full Changelog

[4.8.4] Update PeerTube to 8.2.4 Full Changelog

[2.12.3] Update rallly to 4.12.3 Full Changelog Honor HTTP_PROXY/HTTPS_PROXY for outbound fetch (#2897) Never proxy loopback traffic and exempt the container healthcheck (#2901) Assemble calendar dates from formatToParts for small-ICU builds (#2900) Fix doubled "v" prefix on the control panel version tile (#2887)

[1.17.12] Update pocketbase to 0.39.11 Full Changelog Fixed "API preview" examples (#7782, #7785). Other minor UI improvements (fixed sortable dragend event handling, allow ESC to workaround TAB trap for the rule fields, allow new duplicated collection to edit the collection of relation fields, updated shablon, updated npm dev dependencies, etc.). Bumped golang.org/x/* deps and the min Go GitHub action version to 1.26.6 because it comes with some minor bug and security fixes.

[2.11.3] Update formbricks to 5.3.4 Full Changelog fix(surveys): stop no-overlay surveys blocking the host page (backport #8804 to release/5.3) by @pandeymangg in #8814

[1.100.0] Update audiobookshelf to 2.36.0 Full Changelog Logout all devices button on account page (in #5395) Auth sessions table on account page w/ ability to logout of individual sessions (in #5400) Weak protocol validation for OIDC post-login callback URL by @mikiher in #5386 User delete endpoint allowing for root account deletion by @mikiher in #5370 API and websocket authentication allowing refresh tokens by @mikiher in #5387 Bulk library item download endpoint not checking access on individual items by @mikiher in #5388 Manual podcast episode match not setting the enclosure url #5317 by @mikiher in #5318 Changing user password invalidates all auth sessions (in #5393) Extend refresh token grace period to 10 minutes and allow REFRESH_TOKEN_GRACE_PERIOD env variable override #5281 by @DanielAshley in #5376 API: New GET endpoints /api/me/progress, /api/me/bookmarks, /api/me/bookmarks/:libraryItemId by @Vito0912 in #5363

[1.29.1] Update ampache to 8.0.1 Full Changelog Show Catalog name on song pages Increase redirect count on Podcast Episode download from 5 to 10 Lock database connection on catalog actions to avoid repeats and deadlocks An unrecognised transcode_TYPE value (e.g. transcode_mp3 = "falsed") no longer counts as enabling transcoding; only allowed, required and false are accepted and anything else is logged and treated as false Many possible nullable database column issues fixed Don't lock the UI on larger click operations. (e.g. Album delete) Core::generate_random_key() hashed a predictable seed instead of drawing directly from a secure random source; it backs session ids, api keys and the CSRF form token, and now uses random_bytes() for the full 128 bits Login compared the stored password hash to the submitted one with ==/in_array() instead of a constant-time comparison; both now use hash_equals() A podcast feed's own <title> was used unsanitized as a folder name, so a hostile feed containing ../ could create directories and write episode files outside the catalog New users are given the default transcode_bitrate of 128000 bps instead of 32